加密是对信息进行编码和解码的技术,它通过一定的算法(密钥)将原本可以直接阅读的明文信息转换成密文形式。密钥即是密文的钥匙,有私钥和公钥之分。在传输数据时,如果担心被他人监听或截获,就可以在传输前先使用公钥对数据加密处理,然后再行传送。这样,只有掌握私钥的用户才能解密这段数据,除此之外的其他人即便截获了数据,一般也很难将其破译为明文信息。
一言以蔽之,在生产环境中使用密码进行口令验证终归存在着被暴力破解或嗅探截获的风险。如果正确配置了密钥验证方式,那么sshd服务程序将更加安全。我们下面进行具体的配置,其步骤如下。
第1步:在客户端主机中生成“密钥对”。
[root@linuxprobe ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):按回车键或设置密钥的存储路径
Created directory "/root/.ssh".
Enter passphrase (empty for no passphrase):直接按回车键或设置密钥的密码
Enter same passphrase again:再次按回车键或设置密钥的密码
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
40:32:48:18:e4:ac:c0:c3:c1:ba:7c:6c:3a:a8:b5:22 root@linuxprobe.com
The key"s randomart image is:
+--[ RSA 2048]----+
|+*..o . |
|*.o + |
|o* . |
|+ . . |
|o.. S |
|.. + |
|. = |
|E+ . |
|+.o |
+-----------------+
第2步:把客户端主机中生成的公钥文件传送至远程主机:
[root@linuxprobe ~]# ssh-copy-id 192.168.10.10
The authenticity of host "192.168.10.20 (192.168.10.10)" can"t be established.
ECDSA key fingerprint is 4f:a7:91:9e:8d:6f:b9:48:02:32:61:95:48:ed:1e:3f.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.10.10"s password:此处输入远程服务器密码
Number of key(s) added: 1
Now try logging into the machine, with: "ssh "192.168.10.10""
and check to make sure that only the key(s) you wanted were added.
第3步:对服务器进行设置,使其只允许密钥验证,拒绝传统的口令验证方式。记得在修改配置文件后保存并重启sshd服务程序。
[root@linuxprobe ~]# vim /etc/ssh/sshd_config
………………省略部分输出信息………………
74
75 # To disable tunneled clear text passwords, change to no here!
76 #PasswordAuthentication yes
77 #PermitEmptyPasswords no
78 PasswordAuthentication no
79
………………省略部分输出信息………………
[root@linuxprobe ~]# systemctl restart sshd
第4步:在客户端尝试登录到服务器,此时无须输入密码也可成功登录。
[root@linuxprobe ~]# ssh 192.168.10.10
Last login: Mon Apr 13 19:34:13 2017
无论是Samba服务还是NFS服务,都要把挂载信息写入到/etc/fstab中,这样远程共享资源就会自动随服务器开机而进行挂载。虽然这很方...
实用工具到现在为止你肯定对 UNIX 系统已经有了一些大概的理解和一些命令的基本使用方式。本教程将介绍一些非常基本的但重要的 U...
dos=high,umb 则dos将自身装入高端内存(high)并能管理上位内存(umb).noumb 则不管理上位内存.在写入dos=high及umb 前应装入devic...
扫锚工具:xscan.exe基本格式xscan -host 起始IP[-终止IP] 检测项目 [其他选项] 扫锚起始IP到终止IP段的所有主机信息xscan -file...
容器中可以运行一些网络应用,要让外部也可以访问这些应用,可以通过 -P 或 -p 参数来指定端口映射。当使用 -P 标记时,Docker ...